CVE-2026-19377

MediumCVSS 6.0

Published: 15/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.08%

0th percentile - higher than 0% of all known CVEs

Summary

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.

Risk Assessment

An attacker can intercept or modify network traffic, compromising the confidentiality and integrity of data transmitted through the tunnel.

Recommendation

Update Cato Client to the latest version containing the certificate validation fix. Monitor tunnel traffic for suspicious activity.

Other vulnerabilities in Cato Client

CVE-2026-12374Medium
A vulnerability in the PrivilegedHelperTool XPC service in Cato Client before version 5.13.1 on macOS is caused by improper certificate validation and a TOCTOU race condition. This allows a local authenticated attacker to escalate privileges to root using a self-signed certificate and a symlink swap during package installation.

Original NVD description (English source)

Improper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence (PoP) server and intercept or modify tunnel traffic.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS